Currently Empty: ₦0.00
Outcome: By the end of this guide, you will have a repeatable security routine for a WordPress website, a working backup-and-restore plan, and a short incident checklist you can follow under pressure.
WordPress security is not one magic plugin. It is a chain of small controls: keeping software current, limiting access, backing up correctly, reducing attack surfaces, and noticing trouble early. The official WordPress hardening guide recommends a layered approach because no single control can remove every risk.
Before you begin
- Administrator access to WordPress
- Access to your hosting dashboard or cPanel
- A safe place outside the website to store backups
- Thirty to sixty minutes for the first pass
If you are still deciding how to build your site, first read how to create a website in Nigeria without coding. If performance is your immediate problem, use our separate WordPress speed guide; security and speed should be tested together rather than traded against each other.
1. Make an inventory
Write down your domain registrar, host, WordPress administrator accounts, active theme, active plugins, email delivery service, payment tools, and analytics tools. Add who controls each account and where recovery codes are stored. You cannot protect assets you have forgotten.
Template: Asset | Owner | Login URL | Two-factor enabled? | Recovery method | Last reviewed.
2. Back up before changing anything
Create a full backup containing both files and the database. Download or copy it to storage that is not on the same hosting account. A backup sitting beside the compromised site may be deleted with it. Keep more than one restore point and label each with its date.
Then perform the step people skip: test a restore on staging or ask your host to explain the restore process. A backup is only useful when it can be restored. Record the approximate recovery time.
3. Update WordPress, themes, and plugins
In Dashboard → Updates, install supported updates after taking the backup. Remove abandoned or unused extensions instead of merely deactivating them. Every unnecessary plugin increases maintenance work and may add another vulnerable component. Use plugins from reputable sources, review changelogs, and avoid nulled themes or plugins.
4. Protect the hosting and registrar accounts
Your WordPress login is not the only door. Turn on two-factor authentication for the domain registrar, hosting account, primary email account, and any CDN. Use a unique password generated by a password manager. Do not reuse the password from a social account or shared office computer.
5. Clean up WordPress users
Go to Users → All Users. Remove accounts that no longer need access. Give each person the lowest role that lets them do their work: an author normally does not need administrator rights. Never share one administrator account among a team because you lose accountability.
6. Strengthen login security
Use long unique passwords, enable two-factor authentication, and limit repeated failed logins with a reputable security tool or host feature. Do not rely on changing the login URL alone; it may reduce noise but is not a replacement for strong authentication.
Store emergency recovery codes offline. Test a second administrator recovery route before you need it.
7. Use HTTPS everywhere
Confirm that the browser shows HTTPS on the home page, login, checkout, and forms. Set the WordPress Address and Site Address consistently, redirect HTTP to HTTPS at the server or CDN, and fix mixed-content warnings. Do not enter credentials on an insecure page.
8. Review file editing and permissions
On production sites, consider disabling theme and plugin editing from the dashboard by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php. Ask your host to confirm appropriate ownership and permissions; avoid giving files broad write access just to silence an error. Keep wp-config.php protected and never publish database credentials in screenshots or support chats.
9. Add a web application firewall and basic monitoring
A host-level or cloud firewall can block common malicious requests before WordPress processes them. Configure alerts for administrator logins, plugin changes, new users, malware findings, and downtime. Alerts should go to an address someone actually checks.
10. Secure forms and comments
Use spam protection, validate uploads, restrict allowed file types, and avoid collecting information you do not need. Test contact forms after every major plugin or caching change. Delete abandoned forms because forgotten endpoints can still attract automated abuse.
11. Protect the database and scheduled tasks
Use the database credentials generated by your host, not a simple memorable password. Review backups and scheduled jobs for unexpected entries. If you run an online store or membership site, verify that order, subscription, and enrolment jobs are executing normally.
12. Use staging for risky changes
Test major WordPress, PHP, theme, and plugin upgrades on staging first. Check the home page, menus, forms, login, search, checkout, mobile layout, and email delivery. Then deploy during a low-traffic window with a rollback point ready.
13. Review logs monthly
Look for repeated failed logins, unexpected administrator creation, unexplained traffic spikes, unfamiliar file changes, and outbound mail bursts. A single failed login is normal; a pattern from many addresses or a successful login you do not recognize deserves investigation.
14. Prepare an incident response card
- Put the site into a controlled maintenance state if visitors are at risk.
- Preserve logs and take a snapshot before cleaning.
- Reset hosting, registrar, email, database, and WordPress credentials from a clean device.
- Remove unauthorized users and replace compromised files with clean copies.
- Patch the entry point, restore if necessary, and test every critical path.
- Notify affected people when law, contracts, or good practice require it.
- Document what happened and prevent the same path from reopening.
15. Set a maintenance calendar
- Weekly: check updates, backup success, uptime, and security alerts.
- Monthly: test forms, inspect users, remove unused extensions, and review logs.
- Quarterly: test a restore, rotate shared access, and review the asset inventory.
- Annually: review hosts, licences, recovery contacts, and the full incident plan.
Common mistakes
- Installing several overlapping security plugins and creating conflicts
- Keeping a backup only on the same server
- Ignoring the registrar and email accounts
- Giving every helper administrator access
- Updating production without a rollback plan
- Assuming a padlock means the whole application is secure
Troubleshooting
Locked out after enabling two-factor authentication? Use a recovery code or the documented host-level recovery route. Do not disable random plugins in production without a backup.
An update breaks the layout? Roll back from your tested restore point, reproduce the issue on staging, and check PHP, theme, and plugin compatibility.
Malware returns after cleaning? The original access path may remain open. Rotate every related credential, inspect administrator accounts and scheduled tasks, update vulnerable components, and involve the host or a specialist.
Your 30-minute action plan
- Take and download a full backup.
- Turn on two-factor authentication for hosting, email, registrar, and WordPress.
- Update supported software and remove unused extensions.
- Delete stale users and reduce roles.
- Create a weekly calendar reminder and save the incident card.
Useful references
Go further with guided practice
If you want to build the underlying skills—not just copy a checklist—the verified WordPress for Beginners: Build Professional Websites from Scratch course teaches complete beginners how to install WordPress, understand the dashboard, work with Elementor, and build real websites. Use this checklist alongside the course so every practice project starts with safer habits.
Ready to turn learning into practical skills?
Apply to Ziflite Academy and tell us what you want to learn or build. We’ll help you identify the most suitable Academy plan for your goal.
